Development inspector capabilities¶
The Development Inspector capability-control platform is centralized behind the canonical per-user broker. This registry inventory is paired with the consolidated Capability control authoring workflow.
The canonical broker evidence, bounded telemetry, and T1/T2a execution
contracts are documented in Control evidence and telemetry.
Phase 3 deleted the legacy server, raw client, discovery, and standalone
authority. pulp inspect remains deliberately static/offline; live typed
operations use pulp control and the generated pulp_control_* MCP family.
Source components, schemas, or a target declaration do not imply live
reachability.
The earlier temporary capability reduction while Phases 4–7 built that replacement is now closed for the typed T0/T1 client foundation. It did not preserve a legacy fallback: operations without a canonical executor or grant remain unavailable.
This page records the checked baseline so public descriptions do not confuse implemented building blocks with an activated authority path. The trust boundaries and explicit non-claims are defined in the capability-control threat model.
Capability contract¶
Every protocol method is assigned exactly one stable capability in
inspect/include/pulp/inspect/protocol_methods.inc. Capability IDs, risk,
side effect, executor, evidence, grantability, and named-profile membership live
in inspect/include/pulp/inspect/capability_definitions.inc. The C++ registries
reject duplicate method/capability IDs and test every ID round trip. The frozen
registry also declares operation schemas and digests, build feature, runtime
contexts, host tiers, activation, policy/grant scope, cancellation/timeout
behavior, and compatibility state.
Operation schemas are closed, versioned, and resource-bounded. A shipped
manifest is an upper bound, never a grant. Effective authority requires all
seven terms: implemented, built, host_available, activated,
policy_eligible, client_granted, and session_live. Missing terms deny by
default. Capability dispatch is fail-closed before an executor runs.
The profile columns below are static policy membership, not current runtime availability.
| Canonical capability (legacy spelling) | observe |
develop |
Current reality |
|---|---|---|---|
dev.pulp.instance/read@1 (session.describe) |
yes | yes | Broker-owned T0/T1 executor returns the exact active registration, tier, publication generation, build/artifact identity, liveness generation, and declared capabilities after canonical admission |
dev.pulp.session/control@1 (session.control) |
no | yes | Broker lease/grant machinery exists; no general product host adapter |
dev.pulp.state/read@1 (state.read) |
yes | yes | T0/T1 runtime executor returns bounded parameter catalog/value snapshots against the shared StateStore mutation generation, with explicit sensitive-field redaction; CLI/MCP use the canonical typed client |
dev.pulp.gpu/health.read@1 (gpu.health.read) |
yes | yes | Exact-instance sensitive read of a bounded immutable snapshot; control-enabled Standalone composes the live UI-thread capture provider, but its unratified capture-upper-bound remains startup-unverified until Vellum present/source/shader identity and correlated A2T evidence exist |
dev.pulp.render/offline@1 (render.offline) |
no | no | T0-only headless executor resolves authority-bound, launcher-trusted in-memory inputs, renders through OfflineRenderHost, and publishes broker-owned WAV artifacts; no profile enables it implicitly |
dev.pulp.ui/observe@1 (ui.read) |
yes | yes | Ordinary Standalone composition snapshots the exact main-thread Pulp view tree, optionally selects one unique node ID and removes geometry, and publishes a bounded sensitive broker artifact |
dev.pulp.diagnostics/read@1 (diagnostics.read) |
yes | yes | Ordinary Standalone composition publishes bounded typed host and author-supplied diagnostic items as a sensitive broker artifact |
dev.pulp.logs/read@1 (logs.read) |
yes | yes | Ordinary scripted-UI Standalone composition pages the bounded live JS console ring by monotonic sequence and publishes a sensitive broker artifact; a declared capability without a live ScriptedUi provider fails HostUnavailable rather than returning a deceptive empty page |
dev.pulp.ui/capture@1 (capture.image) |
yes | yes | The exact-instance main-thread executor reuses InspectorCaptureSource for bounded window PNGs and the Pulp-owned exact-target adapter for node PNGs; both publish sensitive ACL-bound broker artifacts |
dev.pulp.ui/input@1 (ui.input) |
no | yes | Grant-controlled ordinary Standalone composition accepts one bounded pointer, keyboard, focus, or UTF-8 text event for an exact registration/view-generation/node target on the fenced main thread; the installed-host seam binds retained state to a broker-projected opaque authority and subscribes exact-owner cleanup to revoke, expiry, disconnect, and teardown |
dev.pulp.trace/control@1 (trace.control) |
no | yes | Injected exact-T1 main-thread Motion executor provides authority-bound geometry/scroll trace ownership, bounded preloaded-fixture scrub/play/pause, and finite redacted cost snapshots; no generic raw Inspector route |
dev.pulp.trace/session-control@1 (trace.session.control) |
no | yes | pulp trace start/stop and matching MCP tools use canonical control only; the reusable host observability bundle dispatches the exact admitted instance when an adapter publishes it |
dev.pulp.state/parameter-gesture@1 (state.write) |
no | yes | T1 main-thread exact-slot executor atomically claims the shared StateStore generation and rolls back failed brackets without overwriting newer writers; broker grant/consent remains mandatory |
dev.pulp.test/input@1 (test.input) |
no | yes | Controller-gated ordinary Standalone composition maps monotonic typed note and transport requests onto its existing bounded test-input host; controller/authority/session end releases notes, restores the pre-control transport snapshot, and clears sequencing for the stable controller principal even when the operation used a narrower grant |
dev.pulp.authoring/tweaks@1 (authoring.tweaks) |
no | yes | Controller-gated ordinary Standalone composition decodes only the frozen bounded tweak object and requires an explicit typed author callback; successful receipts report the author-owned applied generation |
dev.pulp.telemetry/subscribe@1 (telemetry.stream) |
no | yes | The host observability bundle exposes typed subscribe, poll, and unsubscribe actions over the bounded/redacting tap; exact host publication still determines availability |
dev.pulp.runtime/reload@1 (runtime.reload) |
no | no | Frozen contract; no current executor or grant path |
dev.pulp.runtime/evaluate@1 (runtime.eval) |
no | no | Research-unsafe acknowledged manifests may inject the bounded exact-instance evaluator; grants require broker-owned single-use consent, and results/errors are size-bounded and redacted |
dev.pulp.artifact/read@1 (artifact.read) |
no | no | Publication-bound typed client rechecks exact original lineage and broker ACL for every chunk |
dev.pulp.sequencer/state.read@1 (sequencer.state.read) |
yes | yes | Main-thread executor copies one state::SequencerStateChannel UI-side triple-buffer snapshot and seqlock playhead out of the channel before returning; it never touches the audio-side publication methods and never drains the applied-edit queue the owning UI consumer needs |
dev.pulp.sequencer/state.edit@1 (sequencer.state.edit) |
no | yes | Grant-controlled main-thread executor submits one bounded typed step edit into the single-producer command FIFO; a full FIFO refuses with a retryable ResourceExhausted rather than blocking or dropping, and no audio-thread method is reachable from the operation |
dev.pulp.sequencer/transport.loop.read@1 (sequencer.transport.loop.read) |
yes | yes | Fenced main-thread sensitive read of the live MasterTransport accepted loop-control state: loop endpoints, enabled flag, transport running state, and the loop-state sequence. A reset, failed prepare, or transport that has never prepared refuses HostUnavailable rather than reporting a loop no transport has accepted |
dev.pulp.sequencer/transport.loop.write@1 (sequencer.transport.loop.write) |
no | yes | Grant-controlled fenced main-thread receipt operation with action-discriminated set-range/set-enabled input. Endpoints arrive already snapped and are never snapped for the caller; the receipt carries the transport's own acceptance, and every TransportError maps to its own distinct refusal message |
dev.pulp.timeline/document-session@1 (timeline.document.session) |
no | yes | Controller-gated background executor opens, applies, diffs, undoes, and redoes one exact-instance timeline::DocumentSession; the broker projects the session's own CommandAuthority/ConflictCode verdict rather than re-deciding it, refuses a writer profile escalation to trusted, and carries optimistic expected_revision plus idempotency_key replay through unchanged |
dev.pulp.graph/sample-region.read@1 (graph.sample-region.read) |
yes | yes | Host-main bounded read of prepared sample-region summaries and, when requested, the closed structural definition. |
dev.pulp.graph/sample-region.edit@1 (graph.sample-region.edit) |
no | yes | Develop-only host-main transaction over one private prepared topology candidate; lease, generation, proof, cancellation, and atomic publication are required. |
dev.pulp.unavailable/operation@1 (unavailable) |
no | no | Filesystem/editor-launch operations remain unavailable by policy |
off grants nothing. custom starts from an empty exact allow-list. develop
deliberately excludes runtime.eval; no profile or target declaration implies
that high-risk authority.
Typed operations¶
Each row below is one typed operation the frozen control registry declares in
inspect/src/control_manifest.cpp, paired with the capability contract that
gates it and the evidence kind a successful call returns. A capability may gate
more than one operation, so documenting the capability alone does not describe
the callable surface. Input and output JSON Schema bodies stay in the registry;
pulp control capabilities --json prints the same inventory offline.
A listed operation is a frozen contract, never a grant. Effective authority still requires every permission term, and an operation whose capability has no executor on the target host fails closed.
| Typed operation | Gating capability (legacy spelling) | Result |
|---|---|---|
dev.pulp.instance/read@1 |
dev.pulp.instance/read@1 (session.describe) |
response |
dev.pulp.session/control@1 |
dev.pulp.session/control@1 (session.control) |
receipt |
dev.pulp.state/read@1 |
dev.pulp.state/read@1 (state.read) |
response |
dev.pulp.gpu/health.read@1 |
dev.pulp.gpu/health.read@1 (gpu.health.read) |
response |
dev.pulp.render/offline@1 |
dev.pulp.render/offline@1 (render.offline) |
artifact |
dev.pulp.ui/observe@1 |
dev.pulp.ui/observe@1 (ui.read) |
artifact |
dev.pulp.diagnostics/read@1 |
dev.pulp.diagnostics/read@1 (diagnostics.read) |
artifact |
dev.pulp.logs/read@1 |
dev.pulp.logs/read@1 (logs.read) |
artifact |
dev.pulp.ui/capture@1 |
dev.pulp.ui/capture@1 (capture.image) |
artifact |
dev.pulp.ui/input@1 |
dev.pulp.ui/input@1 (ui.input) |
receipt |
dev.pulp.trace/control@1 |
dev.pulp.trace/control@1 (trace.control) |
receipt |
dev.pulp.trace/session-control@1 |
dev.pulp.trace/session-control@1 (trace.session.control) |
response |
dev.pulp.state/parameter-gesture@1 |
dev.pulp.state/parameter-gesture@1 (state.write) |
receipt |
dev.pulp.test/input@1 |
dev.pulp.test/input@1 (test.input) |
receipt |
dev.pulp.authoring/tweaks@1 |
dev.pulp.authoring/tweaks@1 (authoring.tweaks) |
receipt |
dev.pulp.telemetry/subscribe@1 |
dev.pulp.telemetry/subscribe@1 (telemetry.stream) |
stream |
dev.pulp.runtime/reload@1 |
dev.pulp.runtime/reload@1 (runtime.reload) |
receipt |
dev.pulp.runtime/evaluate@1 |
dev.pulp.runtime/evaluate@1 (runtime.eval) |
receipt |
dev.pulp.timeline/document-session@1 |
dev.pulp.timeline/document-session@1 (timeline.document.session) |
receipt |
dev.pulp.graph/sample-region.read@1 |
dev.pulp.graph/sample-region.read@1 (graph.sample-region.read) |
response |
dev.pulp.graph/sample-region.edit@1 |
dev.pulp.graph/sample-region.edit@1 (graph.sample-region.edit) |
receipt |
dev.pulp.artifact/read@1 |
dev.pulp.artifact/read@1 (artifact.read) |
artifact-chunk |
dev.pulp.sequencer/state.read@1 |
dev.pulp.sequencer/state.read@1 (sequencer.state.read) |
response |
dev.pulp.sequencer/state.edit@1 |
dev.pulp.sequencer/state.edit@1 (sequencer.state.edit) |
receipt |
dev.pulp.sequencer/transport.loop.read@1 |
dev.pulp.sequencer/transport.loop.read@1 (sequencer.transport.loop.read) |
response |
dev.pulp.sequencer/transport.loop.write@1 |
dev.pulp.sequencer/transport.loop.write@1 (sequencer.transport.loop.write) |
receipt |
Canonical control foundation¶
The optional pulp::inspect-control component contains broker-owned identity,
registration, grant, typed admission, receipt, cancellation, quota, progress,
artifact-lineage, local carrier, trusted-host inventory, and launcher
foundations. pulp::inspect-client is the canonical control client, not the
deleted raw Inspector client. The optional macOS pulp-control-broker owns one
per-user LocalSocket endpoint and composes enrollment, host routing,
execution, service, and endpoint ownership. Trusted T0/T1 enrollment can
publish exact registrations; unsupported tiers and missing executors fail
closed.
Darwin CLI installs place the broker beside pulp and pulp-cpp and reconcile
the owner-only dev.pulp.control-broker LaunchAgent. A successful
reconciliation proves only reachable-unverified; install-time code-signature
validation is an integrity check, not a publisher-trust or authorization
decision. Canonical ~/.pulp/bin installs activate automatically. A custom
install root requires explicit acceptance on first install, and an upgrade may
reuse it only when the existing owned plist already names that exact broker
path. Ephemeral socket and liveness files remain separate from owner-private
durable receipts and artifacts under ~/.pulp/state/control-broker/v1; service
stop or removal leaves that durable state intact.
The installed ControlClient accepts a typed ControlClientTransport
representing one authenticated, connection-bound peer and client identity; its
artifact-read API therefore has no caller-supplied client ID. ControlService
accepts a carrier-verified peer and connection-bound client identity, but has no
executor unless a runtime adapter injects one. The deleted legacy
InspectorSession/server is not a compatibility transport or a second
capability-control authority path.
The control path validates bounded schemas, exact grants, deadlines, idempotency, replay, cancellation, operation quotas, and receipt lineage. The local carrier binds peer process identity and rejects insecure endpoint parents, unsupported transports, malformed input, dead peers, and identity mismatches. These protections do not make an owner-private file secret from malicious code already running as the same OS user.
pulp control and the generated pulp_control_* MCP family are the general
typed clients. Trace lifecycle is a narrow facade over the same client:
pulp trace start/stop accept an optional exact broker-owned --instance ID;
when omitted, the canonical opener retains its fail-closed unambiguous-selection
behavior. They and pulp_trace_start/stop accept no raw host/port or legacy
publication selector and have no legacy Inspector fallback. Offline
trace query --trace, doctor, fetch, and open do not require a live
target.
Checked surface matrix¶
| Area | Present now | Not yet public |
|---|---|---|
| CLI | pulp control profiles; offline pulp inspect audit ARTIFACT; exact-instance pulp control management/call/watch/artifact/revoke; canonical trace start/stop; offline trace analysis. pulp inspect profiles is a compatibility alias through Pulp 0.800.0 on 2026-10-01. |
Raw Inspector discovery/RPC, host/port selectors, newest-instance selection, and Motion wrappers |
| MCP | In-process pulp_control_profiles; generated typed pulp_control_* operations and management tools; canonical pulp_trace_start and pulp_trace_stop. pulp_inspect_profiles is a compatibility alias through Pulp 0.800.0 on 2026-10-01. |
Generic Inspector RPC, raw selectors, and Motion wrappers |
| Build/link/install | Separate protocol, control, canonical client, runtime, telemetry, authoring, and high-risk eval components; ordinary targets do not gain authority merely because components are built. ControlInstalledHost is the explicit T1 composition seam for the authenticated carrier, observability bundle, Motion, exact-target UI, and additional typed host executors, all installed before ready publication. A clean-prefix consumer compiles and runs the installed protocol/control/client targets while rejecting direct GPU/render/format/host/CLI/MCP closure |
Per-target shipped-product declarations and cross-platform verified-peer parity |
| Shipping | Canonical manifests, registry digest, artifact audit, stripped ordinary targets, marker checks, the owner-only macOS health-service LaunchAgent, and a Release installed-author process E2E for all declared ordinary Standalone outcomes, ready-gated exact-host dispatch, artifacts, and authority cleanup | Remaining product declarations and cross-platform release negative controls |
Centralized replacement boundary¶
The replacement is the broker, authenticated carrier, exact registration, typed operation registry, generated clients, grants, receipts, and bounded artifact/telemetry systems. It is not a compatibility wrapper around the deleted Inspector authority. New host tiers or operations must join this composition; they may not add a second broker, discovery service, transport, session registry, client, generic RPC, or filesystem selector.
Centralization is not itself a reason to reduce a supported outcome. Outcomes remain launch requirements unless a specific security or product rationale is recorded for their removal. The retained exclusions are transport or ambient authority surfaces rather than outcomes: raw TCP, host/port and discovery selectors, arbitrary method/command dispatch, and filesystem/editor-launch tweak load/save/autosave/jump. Their bounded typed outcomes use the centralized path instead.
The deleted legacy TCP server/discovery path is not a compatibility fallback. There is one centralized authority path, and unavailable operations remain unavailable until that path owns them end to end rather than falling back to an Inspector selector.
Enrolled installed hosts use a two-phase open/ready handshake. The broker holds the exact registration in a non-discoverable, non-grantable state until the host has installed its executor and acknowledges readiness. Once published, the host and broker exchange generation-checked heartbeats. A missed lease, disconnect, or restart unregisters the exact publication, detaches its router, and cancels retained opaque authority. No host opens a TCP listener, reads a discovery file, or becomes a second broker.
Phase 4 read-only runtime slice¶
dev.pulp.instance/read@1 is settled inside ControlService from
ControlBroker's live registration after exact grant admission and a final
authority checkpoint. It does not ask a host payload to describe its own
identity. Offline jobs and standalone instances are distinguished explicitly,
and a heartbeat advances only the liveness generation; unregister/restart
mints a new registration identity and revokes the old grants.
dev.pulp.state/read@1 is an injected runtime executor. T0 compositions may
install it directly; T1 hosts provide it to the canonical authenticated host
connection. Its resolver receives only the admitted registration plan and an
exact runtime StateStore selection. The adapter runs on the control/host
worker, never the audio thread, performs no mutation or file I/O, and uses the
shared parameter JSON serializer for catalog and values. Requests are bounded
to 4096 unique parameter IDs. Sensitive parameters are omitted unless the
request explicitly opts in, and the response reports the redacted count.
The resolver snapshots StateStore::state_generation() and the executor
rechecks that same store before and after serialization; it has no adapter-side
generation counter.
These adapters do not create a listener, discovery path, CLI command, MCP
tool, capture/eval/reload surface, or legacy Inspector fallback. A
production-stripped manifest still cannot contain an endpoint or either
capability; developer/test/support artifacts remain explicit opt-ins whose
manifests are only an upper bound, not a grant.
High-risk and typed-operation boundaries¶
runtime.eval is arbitrary execution in the UI process. Its retained component
is separately linked and must remain bounded, single-flight, interruptible, and
denied for effectful scripted realms. It is never an implementation path for
MIDI, transport, parameter gestures, authoring controls, or capture.
Typed test input, state changes, UI observation/capture/input, diagnostics, logs, authoring tweaks, telemetry, and Motion outcomes are composed only through the canonical host adapter and its explicit effective grant. Public clients do not reach them through a resurrected raw server, custom fixture wire, filesystem selector, or generic command. Product-specific diagnostics remain an optional typed extension to the built-in host diagnostics. Authoring effects remain an explicit typed hook: declaring that capability without a provider fails host startup instead of returning a false-success receipt.